From Theymos:
It's unfortunately worse than I thought. There's a good chance that the attacker(s) could have executed arbitrary PHP code and therefore could have accessed the database, but I'm not sure yet how difficult this would be. I'm sending out a mass mailing to all Forum users about this.
Summary: The forum will be down for a while. Backups exist and are held by several people. At this time I feel that password hashes were probably not compromised, but I can't say for sure. If you used the same password on bitcointalk.org as on other sites, you may want to change your passwords. Passwords are hashed using sha256crypt with 7500 rounds (very strong). The JavaScript that was injected into bitcointalk.org seems harmless.
Here's what I know: The attacker injected some code into $modSettings['news'] (the news at the top of pages). Updating news is normally logged, but this action was not logged, so the update was probably done in some roundabout way, not by compromising an admin account or otherwise "legitimately" making the change. Probably, part of SMF related to news-updating or modSettings is flawed. Possibly, the attacker was somehow able to modify the modSettings cache in /tmp or the database directly.
Also, the attacker was able to upload a PHP script and some other files to the avatars directory.
http://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_hacked/"The Hole Seekers" ....
Speriamo che non cerchino buchi nei vari wallet
